···528528 '';
529529 };
530530531531+ virtualisation.restrictNetwork =
532532+ mkOption {
533533+ type = types.bool;
534534+ default = false;
535535+ example = true;
536536+ description =
537537+ lib.mdDoc ''
538538+ If this option is enabled, the guest will be isolated, i.e. it will
539539+ not be able to contact the host and no guest IP packets will be
540540+ routed over the host to the outside. This option does not affect
541541+ any explicitly set forwarding rules.
542542+ '';
543543+ };
544544+531545 virtualisation.vlans =
532546 mkOption {
533547 type = types.listOf types.ints.unsigned;
···936950 else "'guestfwd=${proto}:${guest.address}:${toString guest.port}-" +
937951 "cmd:${pkgs.netcat}/bin/nc ${host.address} ${toString host.port}',"
938952 );
953953+ restrictNetworkOption = lib.optionalString cfg.restrictNetwork "restrict=on,";
939954 in
940955 [
941956 "-net nic,netdev=user.0,model=virtio"
942942- "-netdev user,id=user.0,${forwardingOptions}\"$QEMU_NET_OPTS\""
957957+ "-netdev user,id=user.0,${forwardingOptions}${restrictNetworkOption}\"$QEMU_NET_OPTS\""
943958 ];
944959945960 # FIXME: Consolidate this one day.
···11+import ./make-test-python.nix ({
22+ name = "qemu-vm-restrictnetwork";
33+44+ nodes = {
55+ unrestricted = { config, pkgs, ... }: {
66+ virtualisation.restrictNetwork = false;
77+ };
88+99+ restricted = { config, pkgs, ... }: {
1010+ virtualisation.restrictNetwork = true;
1111+ };
1212+ };
1313+1414+ testScript = ''
1515+ import os
1616+1717+ if os.fork() == 0:
1818+ # Start some HTTP server on the qemu host to test guest isolation.
1919+ from http.server import HTTPServer, BaseHTTPRequestHandler
2020+ HTTPServer(("", 8000), BaseHTTPRequestHandler).serve_forever()
2121+2222+ else:
2323+ start_all()
2424+ unrestricted.wait_for_unit("network-online.target")
2525+ restricted.wait_for_unit("network-online.target")
2626+2727+ # Guests should be able to reach each other on the same VLAN.
2828+ unrestricted.succeed("ping -c1 restricted")
2929+ restricted.succeed("ping -c1 unrestricted")
3030+3131+ # Only the unrestricted guest should be able to reach host services.
3232+ # 10.0.2.2 is the gateway mapping to the host's loopback interface.
3333+ unrestricted.succeed("curl -s http://10.0.2.2:8000")
3434+ restricted.fail("curl -s http://10.0.2.2:8000")
3535+ '';
3636+})
···11+# expr and script based on our lsb_release
22+{ stdenv
33+, lib
44+, substituteAll
55+, coreutils
66+, getopt
77+, modDirVersion ? ""
88+}:
99+1010+substituteAll {
1111+ name = "uname";
1212+1313+ src = ./deterministic-uname.sh;
1414+1515+ dir = "bin";
1616+ isExecutable = true;
1717+1818+ inherit coreutils getopt;
1919+2020+ uSystem = if stdenv.buildPlatform.uname.system != null then stdenv.buildPlatform.uname.system else "unknown";
2121+ inherit (stdenv.buildPlatform.uname) processor;
2222+2323+ # uname -o
2424+ # maybe add to lib/systems/default.nix uname attrset
2525+ # https://github.com/coreutils/coreutils/blob/7fc84d1c0f6b35231b0b4577b70aaa26bf548a7c/src/uname.c#L373-L374
2626+ # https://stackoverflow.com/questions/61711186/where-does-host-operating-system-in-uname-c-comes-from
2727+ # https://github.com/coreutils/gnulib/blob/master/m4/host-os.m4
2828+ operatingSystem =
2929+ if stdenv.buildPlatform.isLinux
3030+ then "GNU/Linux"
3131+ else if stdenv.buildPlatform.isDarwin
3232+ then "Darwin" # darwin isn't in host-os.m4 so where does this come from?
3333+ else "unknown";
3434+3535+ # in os-specific/linux module packages
3636+ # --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
3737+ # is a common thing to do.
3838+ modDirVersion = if modDirVersion != "" then modDirVersion else "unknown";
3939+4040+ meta = with lib; {
4141+ description = "Print certain system information (hardcoded with <nixpkgs/lib/system> values)";
4242+ longDescription = ''
4343+ This package provides a replacement for `uname` whose output depends only
4444+ on `stdenv.buildPlatform`. It is meant to be used from within derivations.
4545+ Many packages' build processes run `uname` at compile time and embed its
4646+ output into the result of the build. Since `uname` calls into the kernel,
4747+ and the Nix sandbox currently does not intercept these calls, builds made
4848+ on different kernels will produce different results.
4949+ '';
5050+ license = [ licenses.mit ];
5151+ maintainers = with maintainers; [ artturin ];
5252+ platforms = platforms.all;
5353+ };
5454+}
···11111212stdenv.mkDerivation rec {
1313 pname = "cutemaze";
1414- version = "1.3.1";
1414+ version = "1.3.2";
15151616 src = fetchurl {
1717- url = "https://gottcode.org/cutemaze/${pname}-${version}-src.tar.bz2";
1818- sha256 = "6944931cd39e9ef202c11483b7b2b7409a068c52fa5fd4419ff938b1158c72ab";
1717+ url = "https://gottcode.org/cutemaze/${pname}-${version}.tar.bz2";
1818+ hash = "sha256-hjDlY18O+VDJR68vwrIZwsQAa40xU+V3bCAA4GFHJEQ=";
1919 };
20202121 nativeBuildInputs = [
···3636 '';
37373838 meta = with lib; {
3939+ changelog = "https://github.com/gottcode/cutemaze/blob/v${version}/ChangeLog";
4040+ description = "Simple, top-down game in which mazes are randomly generated";
3941 homepage = "https://gottcode.org/cutemaze/";
4040- description = "Simple, top-down game in which mazes are randomly generated";
4142 license = licenses.gpl3Plus;
4243 maintainers = with maintainers; [ dotlambda ];
4344 platforms = platforms.unix;
+1-1
pkgs/os-specific/linux/lsb-release/lsb_release.sh
···3232@getopt@/bin/getopt --test > /dev/null && rc=$? || rc=$?
3333if [[ $rc -ne 4 ]]; then
3434 # This shouldn't happen.
3535- echo "Warning: Enhanced getopt not supported, please open an issue." >&2
3535+ echo "Warning: Enhanced getopt not supported, please open an issue in nixpkgs." >&2
3636else
3737 # Define all short and long options.
3838 SHORT=hvidrcas